O
Vendor security profile
openremote
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical0
CISA KEV0
Public exploit5
Patch rate%33
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
0
0
0
0
1
2
3
1
2
CVE KEV
CVE severity distribution
9toplam CVE
High6 (67%)
Medium3 (33%)
Patch and exploitation view
%33
Verified patch
%0
CISA KEV
%56
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
7.7
CVE-2026-54641
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
O
Patch verified
7.6
CVE-2026-54640
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
O
Patch verified
4.3
CVE-2026-49439
OpenRemote read-only asset users can write predicted datapoints
O
Patch verifiedEPSS %0
8.3
CVE-2026-81679
OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API
O
Patch status unknownEPSS %0
7.1
CVE-2026-73616
OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference
O
Patch status unknownEPSS %0
5.3
CVE-2026-67310
openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks
O
Patch status unknownEPSS %0
5.3
CVE-2026-65009
OpenRemote before 1.26.2 Information Disclosure via Syslog REST API
O
Patch status unknownEPSS %0
7.2
CVE-2026-62238
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
O
Patch status unknownEPSS %0
8.6
CVE-2026-56784
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
O
Patch status unknownEPSS %0